In the controller I saw a `systems_registerable` action without protection.